@empire-builder-kit/nx 1.0.0-rc.38 → 1.0.0-rc.39

package/src/executors/deployment-plan/deployment-plan.js

@@ -1,6 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.hasContainerArtifacts = hasContainerArtifacts;
 const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
 const devkit_1 = require("@nx/devkit");
 const index_js_1 = require("../../repository-policy/index.js");
 const index_js_2 = require("../../work-markers/index.js");
@@ -12,9 +14,9 @@ function writeGithubOutputs(plan) {
         `foundation_project=${plan.foundationProject ?? ''}`,
         `deployment_profile=${plan.deploymentProfile}`,
         `deployment_region=${plan.deploymentRegion}`,
-        `development_account_id=${plan.deploymentAccounts.development}`,
+        `development_account_id=${plan.deploymentAccounts.development ?? ''}`,
         `staging_account_id=${plan.deploymentAccounts.staging ?? ''}`,
-        `production_account_id=${plan.deploymentAccounts.production}`,
+        `production_account_id=${plan.deploymentAccounts.production ?? ''}`,
         `foundation_profile=${plan.effectiveProductionProfile ?? ''}`,
         `has_slices=${plan.sliceProjects.length > 0 ? 'true' : 'false'}`,
         `ordered_projects=${plan.orderedProjects.join(',')}`,
@@ -23,6 +25,9 @@ function writeGithubOutputs(plan) {
         // One matrix row per selected Slice so the protected OCI build fans out
         // per Slice and architecture instead of looping on one runner.
         `slice_matrix=${JSON.stringify(plan.sliceProjects.map((project) => ({ project })))}`,
+        `has_containers=${plan.containerProjects.length > 0 ? 'true' : 'false'}`,
+        `container_projects=${plan.containerProjects.join(',')}`,
+        `container_matrix=${JSON.stringify(plan.containerProjects.map((project) => ({ project })))}`,
         '',
     ].join('\n'), 'utf8');
 }
@@ -46,8 +51,23 @@ const executor = async (options, context) => {
                 : {}),
             stage: options.stage,
         });
-        devkit_1.logger.info(`[ebk-deployment-plan] validated before AWS access\n${JSON.stringify(plan, null, 2)}`);
-        writeGithubOutputs(plan);
+        const containerProjects = options.action === 'deploy'
+            ? plan.sliceProjects.filter((name) => {
+                const project = context.projectsConfigurations?.projects[name];
+                if (!project?.root)
+                    throw new Error(`Release inventory root is absent for ${name}.`);
+                const inventoryPath = (0, node_path_1.resolve)(context.root, project.root, 'operations/release.json');
+                const local = (0, node_path_1.relative)(context.root, inventoryPath);
+                if ((0, node_path_1.isAbsolute)(local) ||
+                    local === '..' ||
+                    local.startsWith('../') ||
+                    local.startsWith('..\\'))
+                    throw new Error(`Release inventory for ${name} is outside the workspace.`);
+                return hasContainerArtifacts(JSON.parse((0, node_fs_1.readFileSync)(inventoryPath, 'utf8')));
+            })
+            : [];
+        devkit_1.logger.info(`[ebk-deployment-plan] validated before AWS access\n${JSON.stringify({ ...plan, containerProjects }, null, 2)}`);
+        writeGithubOutputs({ ...plan, containerProjects });
         return { success: true };
     }
     catch (error) {
@@ -56,4 +76,31 @@ const executor = async (options, context) => {
     }
 };
 exports.default = executor;
+/** Derive protected OCI work from the committed inventory, not Slice existence. */
+function hasContainerArtifacts(value) {
+    const inventory = value;
+    if (inventory?.schemaVersion !== 1 ||
+        !Array.isArray(inventory.artifactInventory) ||
+        inventory.artifactInventory.length === 0)
+        throw new Error('Release inventory is absent or malformed.');
+    let containers = false;
+    for (const artifact of inventory.artifactInventory) {
+        if (!artifact ||
+            !artifact.finalArtifact ||
+            typeof artifact.finalArtifact.family !== 'string')
+            throw new Error('Release artifact identity is malformed.');
+        if (artifact.finalArtifact.family === 'sst-provider-artifact') {
+            if (artifact.finalArtifact.support !== 'unsupported')
+                throw new Error('Provider artifacts require their declared support boundary.');
+            continue;
+        }
+        if (artifact.finalArtifact.family !== 'oci-image')
+            throw new Error('Release artifact family is unsupported.');
+        if (artifact.finalArtifact.support !== 'supported' ||
+            artifact.finalArtifact.imageConsumption !== 'digest-qualified')
+            throw new Error('OCI artifacts require supported digest-qualified release identity.');
+        containers = true;
+    }
+    return containers;
+}
 //# sourceMappingURL=deployment-plan.js.map

package/src/executors/dev-doctor/dev-doctor.js

@@ -85,11 +85,10 @@ function effectiveProbeAuthorities(rootCertificatePath) {
     return (0, node_fs_1.readFileSync)(rootCertificatePath);
 }
 async function inspectLocalDevelopment(options, context, dependencies = {}) {
-    const stage = (dependencies.personalStageResolver ?? (0, personal_stage_js_1.createPersonalStageResolver)()).resolve().stage;
     const hostname = options.hostname?.trim() ||
         (0, identity_js_1.createFleetHostname)((0, identity_js_1.createFleetId)({
             checkoutPath: context.root,
-            stage,
+            stage: (dependencies.personalStageResolver ?? (0, personal_stage_js_1.createPersonalStageResolver)()).resolve(context.root).stage,
             workspaceName: context.projectName ?? 'workspace',
         }));
     const paths = (0, tls_js_1.localTlsPaths)(options.appData);
@@ -147,9 +146,17 @@ async function inspectLocalDevelopment(options, context, dependencies = {}) {
     const trust = (dependencies.inspectTrust ?? inspectCertificateTrust)(paths.rootCertificate, paths.intermediateCertificate, paths.leafCertificate, hostname);
     let authorities;
     let connectivity = 'missing';
-    if (trust === 'ready' && resolver.length > 0) {
+    {
         try {
-            authorities = effectiveProbeAuthorities(paths.rootCertificate);
+            // Prove the fleet's exact private chain without installing it into the
+            // operating system. Browser automation admits only this chain/origin.
+            authorities =
+                trust === 'ready'
+                    ? effectiveProbeAuthorities(paths.rootCertificate)
+                    : [
+                        (0, node_fs_1.readFileSync)(paths.rootCertificate),
+                        (0, node_fs_1.readFileSync)(paths.intermediateCertificate),
+                    ];
             await (dependencies.probeExplicitTls ?? effects_js_1.probeEphemeralTlsEndpoint)({
                 ca: authorities,
                 certificate: (0, node_fs_1.readFileSync)(paths.leafCertificate),
@@ -162,8 +169,8 @@ async function inspectLocalDevelopment(options, context, dependencies = {}) {
             issues.push(`Supported explicit-port TLS effect probe failed: ${error instanceof Error ? error.message : String(error)}`);
         }
     }
-    else {
-        issues.push('The generated certificate chain is not trusted by the detected user trust provider.');
+    if (trust !== 'ready') {
+        issues.push('System trust is not installed. Use the generated verify-local-browser target for browser-scoped trust; human browsers may require explicit ebk dev setup --trust after reviewing the root.');
     }
     let state;
     if ((0, node_fs_1.existsSync)(paths.gatewayState)) {

package/src/executors/dev-task-cleanup/dev-task-cleanup.d.ts

@@ -0,0 +1,23 @@
+import { type ExecutorContext, type PromiseExecutor } from '@nx/devkit';
+import { type TaskAuthorityEffects } from '../../local-dev/task-authority.js';
+import { createLocalFederatedCredentialTransport } from '../local-deploy/federated-credential-transport.js';
+import { runSstCommand, type SstLifecycleOptions } from '../sst-lifecycle/run-sst-command.js';
+import { inspectNeverCreatedTaskStack, verifyRemovedTaskStack } from './task-stack-absence.js';
+export type DevTaskCleanupOptions = Record<string, never>;
+export interface DevTaskCleanupDependencies {
+    authority?: TaskAuthorityEffects;
+    createTransport?: typeof createLocalFederatedCredentialTransport;
+    environment?: NodeJS.ProcessEnv;
+    preflight?: typeof preflightTaskRemove;
+    inspectStack?: typeof inspectNeverCreatedTaskStack;
+    verifyStack?: typeof verifyRemovedTaskStack;
+    run?: typeof runSstCommand;
+}
+declare function preflightTaskRemove(options: SstLifecycleOptions, context: ExecutorContext, environment: NodeJS.ProcessEnv): Promise<string>;
+/** Internal generated cleanup target: never accepts a caller-selected task. */
+export declare function runDevTaskCleanup(options: DevTaskCleanupOptions, context: ExecutorContext, dependencies?: DevTaskCleanupDependencies): Promise<{
+    success: boolean;
+    taskStack?: 'already-absent';
+}>;
+declare const executor: PromiseExecutor<DevTaskCleanupOptions>;
+export default executor;

package/src/executors/dev-task-cleanup/dev-task-cleanup.js

@@ -0,0 +1,145 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runDevTaskCleanup = runDevTaskCleanup;
+const devkit_1 = require("@nx/devkit");
+const index_js_1 = require("../../aws-authority/index.js");
+const fleet_launcher_js_1 = require("../../local-dev/fleet-launcher.js");
+const local_context_js_1 = require("../../local-dev/local-context.js");
+const task_authority_js_1 = require("../../local-dev/task-authority.js");
+const task_identity_js_1 = require("../../local-dev/task-identity.js");
+const federated_credential_transport_js_1 = require("../local-deploy/federated-credential-transport.js");
+const run_sst_command_js_1 = require("../sst-lifecycle/run-sst-command.js");
+const task_stack_absence_js_1 = require("./task-stack-absence.js");
+async function preflightTaskRemove(options, context, environment) {
+    const invocation = (0, run_sst_command_js_1.buildSstCommandInvocation)('remove', options, context, environment);
+    await (0, run_sst_command_js_1.runSstLifecyclePreflights)('remove', options, context, invocation, {}, environment);
+    return invocation.cwd;
+}
+/** Internal generated cleanup target: never accepts a caller-selected task. */
+async function runDevTaskCleanup(options, context, dependencies = {}) {
+    let transport;
+    let success = false;
+    let alreadyAbsent = false;
+    try {
+        if (!options ||
+            typeof options !== 'object' ||
+            Array.isArray(options) ||
+            Reflect.ownKeys(options).length !== 0) {
+            throw new Error('Task cleanup accepts no caller options, stage, task, or AWS profile overrides.');
+        }
+        const environment = dependencies.environment ?? process.env;
+        if (environment.GITHUB_ACTIONS === 'true') {
+            throw new Error('Task cleanup is available only in the owning local worktree, not GitHub Actions.');
+        }
+        const projectName = context.projectName;
+        const project = projectName
+            ? context.projectsConfigurations?.projects[projectName]
+            : undefined;
+        if (!projectName ||
+            !project?.tags?.includes('type:slice') ||
+            project.tags.includes('scope:foundation')) {
+            throw new Error('Task cleanup requires one Product Slice, never a Foundation.');
+        }
+        const task = (0, task_identity_js_1.resolveTaskIdentity)(context.root);
+        const saved = (0, local_context_js_1.readSavedLocalDevContext)((0, fleet_launcher_js_1.resolveGitCommonDirectory)(context.root));
+        if (saved.kind !== 'ready') {
+            throw new Error('Task cleanup requires a valid saved local development AWS context. Run ebk dev configure.');
+        }
+        const verified = await (0, task_authority_js_1.verifyTaskEnvironment)(context.root, saved.resolution.context, dependencies.authority);
+        (0, task_identity_js_1.assertCurrentTaskEnvironment)(context.root, verified);
+        const region = verified.region;
+        const expectedRoleArn = (0, index_js_1.createStageAuthorityIdentity)({
+            accountId: verified.accountId,
+            partition: region.startsWith('cn-')
+                ? 'aws-cn'
+                : region.startsWith('us-gov-')
+                    ? 'aws-us-gov'
+                    : 'aws',
+            region,
+            stage: 'development',
+        }).deploymentRoleArn;
+        transport = await (dependencies.createTransport ?? federated_credential_transport_js_1.createLocalFederatedCredentialTransport)({
+            account: verified.accountId,
+            expectedRoleArn,
+            profile: saved.resolution.context.profile,
+            region,
+        });
+        await transport.refresh();
+        // Recheck ownership after asynchronous authority acquisition, before mutation.
+        (0, task_identity_js_1.assertCurrentTaskEnvironment)(context.root, verified);
+        if ((0, task_identity_js_1.resolveTaskIdentity)(context.root).taskId !== task.taskId) {
+            throw new Error('Task ownership changed during cleanup authorization.');
+        }
+        const nativeOptions = {
+            expectedRoleArn,
+            foundationStage: 'development',
+            profile: transport.profile,
+            region,
+            stage: (0, task_identity_js_1.taskStage)(task.taskId),
+            stageMode: 'consumer',
+        };
+        const childEnvironment = {
+            ...transport.childEnvironment(environment),
+            AWS_EXPECTED_ACCOUNT_ID: verified.accountId,
+            AWS_REGION: region,
+            EBK_NX_TASK_CLEANUP: task.taskId,
+        };
+        // An absence result must pass the same role/project/task/ownership gates
+        // as removal. Present state still goes through the unchanged native runner.
+        const projectRoot = await (dependencies.preflight ?? preflightTaskRemove)(nativeOptions, context, childEnvironment);
+        const metadata = await (dependencies.inspectStack ?? task_stack_absence_js_1.inspectNeverCreatedTaskStack)({
+            workspaceRoot: context.root,
+            projectRoot,
+            projectName,
+            taskId: task.taskId,
+            verifiedEnvironment: verified,
+            awsEnvironment: childEnvironment,
+        });
+        (0, task_identity_js_1.assertCurrentTaskEnvironment)(context.root, verified);
+        if ((0, task_identity_js_1.resolveTaskIdentity)(context.root).taskId !== task.taskId)
+            throw new Error('Task ownership changed during cleanup inspection.');
+        if (metadata.status === 'already-absent') {
+            alreadyAbsent = true;
+            success = true;
+            devkit_1.logger.info('Task cloud stack is already absent (verified native metadata; no SST removal executed).');
+        }
+        else {
+            const removed = (await (dependencies.run ?? run_sst_command_js_1.runSstCommand)('remove', nativeOptions, context, { environment: childEnvironment })).success;
+            if (removed) {
+                await (dependencies.verifyStack ?? task_stack_absence_js_1.verifyRemovedTaskStack)({
+                    workspaceRoot: context.root,
+                    projectRoot,
+                    projectName,
+                    taskId: task.taskId,
+                    verifiedEnvironment: verified,
+                    awsEnvironment: childEnvironment,
+                });
+                (0, task_identity_js_1.assertCurrentTaskEnvironment)(context.root, verified);
+                if ((0, task_identity_js_1.resolveTaskIdentity)(context.root).taskId !== task.taskId)
+                    throw new Error('Task ownership changed during cleanup verification.');
+            }
+            success = removed;
+        }
+    }
+    catch (error) {
+        devkit_1.logger.error(`Task cloud cleanup failed: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    finally {
+        try {
+            transport?.cleanup();
+        }
+        catch (error) {
+            success = false;
+            devkit_1.logger.error(`Task cleanup credential removal failed: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    return {
+        success,
+        ...(success && alreadyAbsent
+            ? { taskStack: 'already-absent' }
+            : {}),
+    };
+}
+const executor = (options, context) => runDevTaskCleanup(options, context);
+exports.default = executor;
+//# sourceMappingURL=dev-task-cleanup.js.map

package/src/executors/dev-task-cleanup/schema.json

@@ -0,0 +1,9 @@
+{
+  "$schema": "https://json-schema.org/schema",
+  "version": 2,
+  "title": "Empire Builder Kit internal task cloud cleanup",
+  "description": "Remove only this worktree's owned task Slice stack through verified development authority.",
+  "type": "object",
+  "additionalProperties": false,
+  "properties": {}
+}

package/src/executors/dev-task-cleanup/task-stack-absence.d.ts

@@ -0,0 +1,27 @@
+import { S3Client, type S3ClientConfig } from '@aws-sdk/client-s3';
+import { SSMClient, type SSMClientConfig } from '@aws-sdk/client-ssm';
+import { type TaskEnvironment } from '../../local-dev/task-identity.js';
+declare const NATIVE_VERSION = "4.17.1";
+export interface TaskStackAbsenceInput {
+    workspaceRoot: string;
+    projectRoot: string;
+    projectName: string;
+    taskId: string;
+    verifiedEnvironment: TaskEnvironment;
+    awsEnvironment: NodeJS.ProcessEnv;
+}
+export interface TaskStackAbsenceDependencies {
+    s3Client?: (config: S3ClientConfig) => S3Client;
+    ssmClient?: (config: SSMClientConfig) => SSMClient;
+}
+export type TaskStackMetadata = {
+    status: 'present' | 'already-absent';
+    nativeVersion: typeof NATIVE_VERSION;
+};
+/** Accept only the generated static app/home contract; never evaluate config. */
+export declare function resolveStaticTaskApp(input: Pick<TaskStackAbsenceInput, 'workspaceRoot' | 'projectRoot' | 'projectName'>): string;
+/** Read-only, task-exact metadata proof. It grants no permission to remove. */
+export declare function inspectNeverCreatedTaskStack(input: TaskStackAbsenceInput, dependencies?: TaskStackAbsenceDependencies): Promise<TaskStackMetadata>;
+/** A successful native exit cannot conceal retained resources or pending work. */
+export declare function verifyRemovedTaskStack(input: TaskStackAbsenceInput, dependencies?: TaskStackAbsenceDependencies): Promise<void>;
+export {};

package/src/executors/dev-task-cleanup/task-stack-absence.js

@@ -0,0 +1,281 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveStaticTaskApp = resolveStaticTaskApp;
+exports.inspectNeverCreatedTaskStack = inspectNeverCreatedTaskStack;
+exports.verifyRemovedTaskStack = verifyRemovedTaskStack;
+const client_s3_1 = require("@aws-sdk/client-s3");
+const client_ssm_1 = require("@aws-sdk/client-ssm");
+const credential_providers_1 = require("@aws-sdk/credential-providers");
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const ts = require("typescript");
+const identity_js_1 = require("../../aws/identity.js");
+const personal_secret_runtime_js_1 = require("../../cli/personal-secret-runtime.js");
+const task_identity_js_1 = require("../../local-dev/task-identity.js");
+const task_stack_checkpoint_js_1 = require("./task-stack-checkpoint.js");
+// These are provider layout facts, not an alternative SST state engine.
+// SST v4.17.1: pkg/project/provider/aws.go Bootstrap (version 5),
+// pathForData, and provider.go PullState/Lock/Unlock (symbol references, not
+// unstable line numbers).
+// https://github.com/anomalyco/sst/blob/v4.17.1/pkg/project/provider/aws.go
+// https://github.com/anomalyco/sst/blob/v4.17.1/pkg/project/provider/provider.go
+const NATIVE_VERSION = '4.17.1';
+const MAX_PAGES = 4;
+const PAGE_SIZE = 100;
+function refuse(reason) {
+    throw new Error(`Task stack absence could not be proven: ${reason}.`);
+}
+function propertyName(node) {
+    return ts.isIdentifier(node) || ts.isStringLiteral(node)
+        ? node.text
+        : undefined;
+}
+/** Accept only the generated static app/home contract; never evaluate config. */
+function resolveStaticTaskApp(input) {
+    const root = (0, node_fs_1.realpathSync)(input.workspaceRoot);
+    const project = (0, node_fs_1.realpathSync)(input.projectRoot);
+    const path = (0, node_path_1.join)(project, 'sst.config.ts');
+    const child = (0, node_path_1.relative)(root, project);
+    if (!child || child.startsWith('..') || (0, node_path_1.isAbsolute)(child))
+        refuse('the Slice configuration is outside its workspace');
+    if (!(0, node_fs_1.lstatSync)(path).isFile() || (0, node_fs_1.realpathSync)(path) !== path)
+        refuse('the Slice configuration is not a regular owned path');
+    const source = (0, node_fs_1.readFileSync)(path, 'utf8');
+    if (Buffer.byteLength(source) > 1024 * 1024)
+        refuse('the Slice configuration exceeds the inspection bound');
+    const file = ts.createSourceFile(path, source, ts.ScriptTarget.Latest, true);
+    if (ts
+        .transpileModule(source, { fileName: path, reportDiagnostics: true })
+        .diagnostics?.some((diagnostic) => diagnostic.category === ts.DiagnosticCategory.Error))
+        refuse('the Slice configuration has invalid syntax');
+    const exports = file.statements.filter(ts.isExportAssignment);
+    const expression = exports[0]?.expression;
+    if (exports.length !== 1 ||
+        exports[0].isExportEquals ||
+        !expression ||
+        !ts.isCallExpression(expression) ||
+        !ts.isIdentifier(expression.expression) ||
+        expression.expression.text !== '$config' ||
+        expression.arguments.length !== 1 ||
+        !ts.isObjectLiteralExpression(expression.arguments[0]))
+        refuse('the Slice app declaration is not the supported static shape');
+    const config = expression.arguments[0];
+    if (config.properties.some((p) => !p.name || propertyName(p.name) === undefined))
+        refuse('the Slice configuration contains dynamic properties');
+    const apps = config.properties.filter((p) => p.name && propertyName(p.name) === 'app');
+    const app = apps[0];
+    if (apps.length !== 1 || !app || !ts.isMethodDeclaration(app) || !app.body)
+        refuse('the Slice app declaration is dynamic');
+    const statements = app.body.statements;
+    const returned = statements.at(-1);
+    if (statements.slice(0, -1).some((s) => !ts.isVariableStatement(s)) ||
+        !returned ||
+        !ts.isReturnStatement(returned) ||
+        !returned.expression ||
+        !ts.isObjectLiteralExpression(returned.expression))
+        refuse('the Slice app return is dynamic');
+    const properties = returned.expression.properties;
+    if (properties.some((p) => !p.name || propertyName(p.name) === undefined))
+        refuse('the Slice app return contains dynamic properties');
+    const literal = (name) => {
+        const matches = properties.filter((p) => p.name && propertyName(p.name) === name);
+        const property = matches[0];
+        if (matches.length !== 1 ||
+            !property ||
+            !ts.isPropertyAssignment(property) ||
+            !ts.isStringLiteral(property.initializer))
+            refuse(`the Slice ${name} is not an exact literal`);
+        return property.initializer.text;
+    };
+    const name = literal('name');
+    if (name !== input.projectName ||
+        !/^[a-z][a-z0-9-]{0,62}$/.test(name) ||
+        literal('home') !== 'aws')
+        refuse('the Slice app/home differs from the selected generated project');
+    return name;
+}
+/** Read-only, task-exact metadata proof. It grants no permission to remove. */
+async function inspectNeverCreatedTaskStack(input, dependencies = {}) {
+    return inspectTaskStack(input, dependencies, false);
+}
+/** A successful native exit cannot conceal retained resources or pending work. */
+async function verifyRemovedTaskStack(input, dependencies = {}) {
+    await inspectTaskStack(input, dependencies, true);
+}
+async function inspectTaskStack(input, dependencies, verifyRemoval) {
+    const assertOwner = () => {
+        if ((0, task_identity_js_1.assertCurrentTaskEnvironment)(input.workspaceRoot, input.verifiedEnvironment).taskId !== input.taskId)
+            refuse('task ownership changed');
+    };
+    assertOwner();
+    if ((0, personal_secret_runtime_js_1.resolveWorkspaceSstRuntime)(input.workspaceRoot).version !== NATIVE_VERSION)
+        refuse('the native SST version has no reviewed metadata layout');
+    const app = resolveStaticTaskApp(input);
+    const stage = (0, task_identity_js_1.taskStage)(input.taskId);
+    const { accountId, region } = input.verifiedEnvironment;
+    const profile = input.awsEnvironment.AWS_PROFILE;
+    const configFilepath = input.awsEnvironment.AWS_CONFIG_FILE;
+    const filepath = input.awsEnvironment.AWS_SHARED_CREDENTIALS_FILE;
+    if (!profile || !configFilepath || !filepath)
+        refuse('the private authorized AWS credential transport is incomplete');
+    const credentials = (0, credential_providers_1.fromIni)({
+        profile,
+        configFilepath,
+        filepath,
+        clientConfig: {
+            region,
+            endpoint: (0, identity_js_1.canonicalAwsRegionalEndpoint)('sts', region),
+            ignoreConfiguredEndpointUrls: true,
+        },
+    });
+    const common = {
+        region,
+        credentials,
+        maxAttempts: 1,
+        ignoreConfiguredEndpointUrls: true,
+    };
+    const ssm = (dependencies.ssmClient ?? ((config) => new client_ssm_1.SSMClient(config)))({
+        ...common,
+        endpoint: (0, identity_js_1.canonicalAwsRegionalEndpoint)('ssm', region),
+    });
+    // identity.ts validates the Region; replace only the fixed service label.
+    const s3 = (dependencies.s3Client ?? ((config) => new client_s3_1.S3Client(config)))({
+        ...common,
+        endpoint: (0, identity_js_1.canonicalAwsRegionalEndpoint)('ssm', region).replace('https://ssm.', 'https://s3.'),
+    });
+    const signal = AbortSignal.timeout(20_000);
+    try {
+        const bootstrap = await ssm.send(new client_ssm_1.GetParameterCommand({
+            Name: '/sst/bootstrap',
+            WithDecryption: false,
+        }), { abortSignal: signal });
+        if (bootstrap.Parameter?.Name !== '/sst/bootstrap' ||
+            bootstrap.Parameter.Type !== 'String' ||
+            !bootstrap.Parameter.Value ||
+            Buffer.byteLength(bootstrap.Parameter.Value) > 16_384)
+            refuse('the native bootstrap metadata is missing or malformed');
+        let data;
+        try {
+            data = JSON.parse(bootstrap.Parameter.Value);
+        }
+        catch {
+            refuse('the native bootstrap metadata is not JSON');
+        }
+        if (!data ||
+            data.version !== 5 ||
+            typeof data.state !== 'string' ||
+            !/^sst-state-[a-z0-9]{12}$/.test(data.state))
+            refuse('the native bootstrap version or bucket identity is unsupported');
+        const owner = { Bucket: data.state, ExpectedBucketOwner: accountId };
+        const versioning = await s3.send(new client_s3_1.GetBucketVersioningCommand(owner), {
+            abortSignal: signal,
+        });
+        if (versioning.Status !== 'Enabled')
+            refuse('the native state bucket is not versioned');
+        const stateKey = `app/${app}/${stage}.json`;
+        const lockKey = `lock/${app}/${stage}.json`;
+        const contains = async (key) => {
+            let token;
+            const seen = new Set();
+            for (let page = 0; page < MAX_PAGES; page++) {
+                const result = await s3.send(new client_s3_1.ListObjectsV2Command({
+                    ...owner,
+                    Prefix: key,
+                    MaxKeys: PAGE_SIZE,
+                    ...(token ? { ContinuationToken: token } : {}),
+                }), { abortSignal: signal });
+                if (typeof result.IsTruncated !== 'boolean' ||
+                    (result.Contents !== undefined && !Array.isArray(result.Contents)))
+                    refuse('the current-object listing is malformed');
+                if ((result.Contents?.length ?? 0) > PAGE_SIZE)
+                    refuse('the current-object page exceeds the inspection bound');
+                for (const object of result.Contents ?? []) {
+                    if (typeof object.Key !== 'string' || !object.Key.startsWith(key))
+                        refuse('the object listing escaped its exact prefix');
+                    if (object.Key === key)
+                        return true;
+                }
+                if (!result.IsTruncated)
+                    return false;
+                token = result.NextContinuationToken;
+                if (!token || seen.has(token))
+                    refuse('the object listing cursor is ambiguous');
+                seen.add(token);
+            }
+            refuse('the object listing exceeded its bounded page count');
+        };
+        if (await contains(lockKey))
+            refuse('the exact task native lock is present');
+        if (await contains(stateKey)) {
+            if (verifyRemoval) {
+                await (0, task_stack_checkpoint_js_1.verifyRemovedTaskCheckpoint)(s3, owner, stateKey, `organization/${app}/${stage}`, signal);
+                if (await contains(lockKey))
+                    refuse('the exact task native lock appeared after removal');
+            }
+            assertOwner();
+            if (resolveStaticTaskApp(input) !== app)
+                refuse('the Slice app changed during inspection');
+            return { status: 'present', nativeVersion: NATIVE_VERSION };
+        }
+        let keyMarker;
+        let versionMarker;
+        const seen = new Set();
+        let complete = false;
+        for (let page = 0; page < MAX_PAGES; page++) {
+            const result = await s3.send(new client_s3_1.ListObjectVersionsCommand({
+                ...owner,
+                Prefix: stateKey,
+                MaxKeys: PAGE_SIZE,
+                ...(keyMarker ? { KeyMarker: keyMarker } : {}),
+                ...(versionMarker ? { VersionIdMarker: versionMarker } : {}),
+            }), { abortSignal: signal });
+            if (typeof result.IsTruncated !== 'boolean' ||
+                [result.Versions, result.DeleteMarkers].some((entries) => entries !== undefined && !Array.isArray(entries)))
+                refuse('the version listing is malformed');
+            for (const entry of [
+                ...(result.Versions ?? []),
+                ...(result.DeleteMarkers ?? []),
+            ]) {
+                if (typeof entry.Key !== 'string' || !entry.Key.startsWith(stateKey))
+                    refuse('the version listing escaped its exact prefix');
+                if (entry.Key === stateKey)
+                    refuse('the exact task state has retained versions or delete markers');
+            }
+            if ((result.Versions?.length ?? 0) + (result.DeleteMarkers?.length ?? 0) >
+                PAGE_SIZE)
+                refuse('the version page exceeds the inspection bound');
+            if (!result.IsTruncated) {
+                complete = true;
+                break;
+            }
+            keyMarker = result.NextKeyMarker;
+            versionMarker = result.NextVersionIdMarker;
+            const cursor = JSON.stringify([keyMarker, versionMarker]);
+            if (!keyMarker || !keyMarker.startsWith(stateKey) || seen.has(cursor))
+                refuse('the version listing cursor is ambiguous');
+            seen.add(cursor);
+        }
+        if (!complete)
+            refuse('the version listing exceeded its bounded page count');
+        // Close the metadata observation window before returning an absence result.
+        if ((await contains(stateKey)) || (await contains(lockKey)))
+            refuse('task state or lock appeared during the absence inspection');
+        assertOwner();
+        if (resolveStaticTaskApp(input) !== app)
+            refuse('the Slice app changed during inspection');
+        return { status: 'already-absent', nativeVersion: NATIVE_VERSION };
+    }
+    catch (error) {
+        if (error instanceof task_stack_checkpoint_js_1.NativeTaskCheckpointError ||
+            (error instanceof Error &&
+                error.message.startsWith('Task stack absence could not be proven:')))
+            throw error;
+        // Provider errors can contain private bucket names or request details.
+        refuse('a required native metadata read or ownership recheck failed');
+    }
+    finally {
+        s3.destroy();
+        ssm.destroy();
+    }
+}
+//# sourceMappingURL=task-stack-absence.js.map

package/src/executors/dev-task-cleanup/task-stack-checkpoint.d.ts

@@ -0,0 +1,12 @@
+import { type S3Client } from '@aws-sdk/client-s3';
+export declare class NativeTaskCheckpointError extends Error {
+}
+/**
+ * Read-only postcondition for the pinned SST checkpoint envelope. It does not
+ * decrypt, retain, repair, or infer physical identities from resource contents.
+ * An empty checkpoint is necessary, not independent physical-absence proof.
+ */
+export declare function verifyRemovedTaskCheckpoint(s3: S3Client, owner: {
+    Bucket: string;
+    ExpectedBucketOwner: string;
+}, key: string, stack: string, signal: AbortSignal): Promise<void>;